内核模块编程求救

iptabler

那上面的这个程序,如何让target执行呢????这下drop,accept ok了把

dreamice

原帖由 iptabler 于 2008-12-21 12:59 发表
我需要的是解决问题,那内核如何才匹配我现在写的这个target呢????
我是了解这个流程阿.....

就是我前面给你回复的。
match可以不写，但应用层的解析程序，你必须实现，然后拷贝到iptables动态链接库的目录下
执行
iptables -t [table] -m [match] -j [your ipt]

iptabler

我知道效率不行,这样所有的包都处理了,没有之前match...
可是我现在连不要效率的都不行....还谈效率????

iptabler

算了,放弃!!!!
感谢大家的帮助,虽然问题没有得到解决...
只怨俺不是搞内核的料

[ 本帖最后由 iptabler 于 2008-12-21 13:31 编辑 ]

Godbach

呵呵，放弃了啊。
其实上面dreamice兄已经给你过建议了。如果你要了解target和match如何搭配工作，那么首先熟悉一下内核的iptables部分代码，看看内核中是如何查找match模块，然后执行target。同时，在研究一下iptables的源码。了解如何命令行代码如何扩展。

独孤九贱的精华帖和端木大侠的博客：http://www.cublog.cn/u/12313/index.html。应该好好学习一下，基本上答复了你的大部分疑问。而且端木大侠的博客上还有一个实例，添加target和match。

是不是学什么的料，也在于能不能发挥自己的积极性去学习和研究。

BTW，不管做什么事情，不要轻言放弃。除非本不是你必须做的或者你不感兴趣。

[ 本帖最后由 Godbach 于 2008-12-21 14:02 编辑 ]

baohuaihuai

一个十分简单的道理，不是你写的任何代码都会被内核调用到。
内核总得有它自己的执行流吧，它不能因为你是大牛就执行你写的代码，或者因为你是菜鸟就忽略你的代码。
你要做的就是先了解你的代码为什么会被执行，或者为什么不会被执行。

ubuntuer

问题更新下,在各位好心人的帮助下,我自己又尝试写了个
ipt_ME.c

#include <linux/module.h> #include <linux/skbuff.h> #include <linux/ip.h> #include <linux/udp.h> #include <linux/icmp.h> #include <net/icmp.h> #include <net/ip.h> #include <net/tcp.h> #include <net/route.h> #include <net/dst.h> #include <linux/netfilter/x_tables.h> #include <linux/netfilter_ipv4/ip_tables.h> #include "ipt_ME.h" #ifdef CONFIG_BRIDGE_NETFILTER #include <linux/netfilter_bridge.h> #endif MODULE_LICENSE("GPL"); MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv4"); static unsigned int reject_tg(struct sk_buff *skb, const struct net_device *in, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;const struct net_device *out, unsigned int hooknum, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;const struct xt_target *target, const void *targinfo) { &nbsp;&nbsp;&nbsp;&nbsp;const struct ipt_me_info *reject = targinfo; &nbsp;&nbsp;&nbsp;&nbsp;const struct iphdr *oiph; &nbsp;&nbsp;&nbsp;&nbsp;const struct tcphdr *oth; &nbsp;&nbsp;&nbsp;&nbsp;struct tcphdr _otcph; &nbsp;&nbsp;printk("me port %d!!!\n",reject->port); &nbsp;&nbsp; &nbsp;&nbsp;oiph = ip_hdr (skb); &nbsp;&nbsp;printk("reject_tg call success!!!\n"); &nbsp;&nbsp;switch (oiph->protocol) &nbsp;&nbsp;&nbsp;&nbsp;{ &nbsp;&nbsp;&nbsp;&nbsp;case IPPROTO_TCP: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;printk ("TCP PACKET!!!\n"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break; &nbsp;&nbsp;&nbsp;&nbsp;case IPPROTO_UDP: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;printk ("UDP PACKET!!!\n"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return NF_DROP; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break; &nbsp;&nbsp;&nbsp;&nbsp;case IPPROTO_ICMP: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;printk ("ICMP PACKET!!!\n"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return NF_DROP; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break; &nbsp;&nbsp;&nbsp;&nbsp;default: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return NF_DROP; &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;oth = skb_header_pointer (skb, ip_hdrlen (skb), sizeof(_otcph), &_otcph); &nbsp;&nbsp;if (oth == NULL) &nbsp;&nbsp;&nbsp;&nbsp;return NF_DROP; &nbsp;&nbsp;if (oth->urg) &nbsp;&nbsp;&nbsp;&nbsp;{ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;printk ("urg ok!!!!!"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return NF_DROP; &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;else &nbsp;&nbsp;&nbsp;&nbsp;{ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;printk ("urg ok!!!!!"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;printk ("s_port:%d,d_port:%d", oth->source, oth->dest); &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;return NF_ACCEPT; } static bool reject_tg_check(const char *tablename, const void *e_void, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;const struct xt_target *target, void *targinfo, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;unsigned int hook_mask) { &nbsp;&nbsp;&nbsp;&nbsp;const struct ipt_me_info *meinfo = targinfo; &nbsp;&nbsp;&nbsp;&nbsp;//const struct ipt_entry *e = e_void; &nbsp;&nbsp;&nbsp;&nbsp;/*if (rejinfo->with == IPT_ICMP_ECHOREPLY) { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;printk("ipt_REJECT: ECHOREPLY no longer supported.\n"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return false; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}*/ &nbsp;&nbsp;&nbsp;&nbsp;printk("me port %d!!!\n",meinfo->port); &nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;return true; } static struct xt_target reject_tg_reg __read_mostly = { &nbsp;&nbsp;&nbsp;&nbsp;.name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= "REJECT", &nbsp;&nbsp;&nbsp;&nbsp;.family&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= AF_INET, &nbsp;&nbsp;&nbsp;&nbsp;.target&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= reject_tg, &nbsp;&nbsp;&nbsp;&nbsp;.targetsize&nbsp;&nbsp;&nbsp;&nbsp;= sizeof(struct ipt_me_info), &nbsp;&nbsp;&nbsp;&nbsp;//.table&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= "filter", &nbsp;&nbsp;&nbsp;&nbsp;.hooks&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD) | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  (1 << NF_INET_LOCAL_OUT), &nbsp;&nbsp;&nbsp;&nbsp;.checkentry&nbsp;&nbsp;&nbsp;&nbsp;= reject_tg_check, &nbsp;&nbsp;&nbsp;&nbsp;.me&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= THIS_MODULE, }; static int __init reject_tg_init(void) { &nbsp;&nbsp;&nbsp;&nbsp;return xt_register_target(&reject_tg_reg); } static void __exit reject_tg_exit(void) { &nbsp;&nbsp;&nbsp;&nbsp;xt_unregister_target(&reject_tg_reg); } module_init(reject_tg_init); module_exit(reject_tg_exit);

ubuntuer

ipt_ME.h

#ifndef _IPT_ME_H #define _IPT_ME_H struct ipt_me_info {     u_int16_t port; }; #endif

Makefile

ifneq ($(KERNELRELEASE),) obj-m := ipt_ME.o else KERNEL_SRC ?= $(firstword $(wildcard /lib/modules/$(shell uname -r)/build /usr/src/linux)) ifeq ($(KERNEL_SRC),) $(error You need to define KERNEL_SRC) endif ifneq ($wildcard $(KERNEL_SRC)/include/linux/modversions.h),) MODVERSIONS = -DMODVERSIONS endif _KVER = $(strip $(shell cat $(KERNEL_SRC)/Makefile | grep -e '^VERSION' | cut -d"=" -f2)) _KPL = $(strip $(shell cat $(KERNEL_SRC)/Makefile | grep -e '^PATCHLEVEL' | cut -d"=" -f2)) _KSUB = $(strip $(shell cat $(KERNEL_SRC)/Makefile | grep -e '^SUBLEVEL' | cut -d"=" -f2)) KERNEL_SERIES=$(_KVER).$(_KPL) ifeq ($(KERNEL_SERIES), 2.6)     TARGET=ipt_ME.ko else     TARGET=ipt_ME.o endif SED = sed IPTABLES_BIN = iptables IPTABLES_SRC = /home/zj/domain/iptables-1.4.2 IPTABLES_INCLUDE = -I$(IPTABLES_SRC)/include IPTABLES_VERSION = $(shell cat $(IPTABLES_SRC)/Makefile | grep -e '^IPTABLES_VERSION:=' | cut -d"=" -f2) IPTABLES_OPTION = -DIPTABLES_VERSION=\

ubuntuer

这样的话,make..make install都是没问题的...
我怀疑是我iptables那一层没写好

Godbach

LS和LZ是一个人吧，两个ID